Skip to content
OpenAdvisories
Medium · 6.5 CVE-2020-10755 EUVD-2020-0061GHSA-v3m2-pg96-w33mPYSEC-2020-228PYSEC-2026-891

Openstack cinder Improper handling of ScaleIO backend credentials

Published Jun 10, 2020 · Updated Aug 4, 2024 · Assigned by redhat

Vendor: Red Hat Product: openstack-cinder Package: cinder Package: cinder Package: cinder Package: os-brick Package: python-os-brick Package: python-os-brick Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the ``connection_info`` element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API, should an attacker discover the Management API endpoint. Source: OpenStack project

Affected products

VendorProductAffectedFixed
Red Hat openstack-cinder all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0, all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 cinder 2:16.1.0-1 —
Debian 14 python-os-brick 3.1.0-1 —
Debian 13 cinder 2:16.1.0-1 —
Debian 13 python-os-brick 3.1.0-1 —
Debian 12 cinder 2:16.1.0-1 —
Debian 12 python-os-brick 3.1.0-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS cinder 2:16.1.0-0ubuntu1 USN-4420-1
Ubuntu 20.04 LTS python-os-brick 3.0.1-0ubuntu1.2 USN-4420-1
Ubuntu 18.04 LTS cinder 2:12.0.9-0ubuntu1.2 USN-4420-1
Ubuntu 18.04 LTS python-os-brick 2.3.0-0ubuntu1.2 USN-4420-1
Ubuntu 16.04 LTS cinder +1 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenStack 16 python3-cinder +1 1:15.3.1-1.20200914173114.00ac80b.el8ost RHSA-2020:4283
Red Hat OpenStack 13 python-cinder +1 1:12.0.10-19.el7ost RHSA-2020:4391

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud Crowbar 9 crowbar-core 6.0+git.1594619891.b75a61d0d-3.25.5 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 crowbar-openstack 6.0+git.1591795073.49cb6400e-3.25.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 grafana 6.2.5-3.12.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 kibana 4.6.3-4.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-barbican 7.0.1~dev24-3.9.5 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-ceilometer 11.1.1~dev7-3.16.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-cinder 13.0.10~dev12-3.22.4 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-dashboard 14.1.1~dev6-3.15.5 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-designate 7.0.2~dev2-3.19.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-heat-templates 0.0.0+git.1582270132.8a20477-3.6.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-ironic 11.1.5~dev6-3.19.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-keystone 14.2.1~dev4-3.22.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-magnum 7.2.1~dev1-3.13.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-manila 7.4.2~dev31-4.24.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-monasca-agent 2.8.2~dev5-3.9.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-neutron 13.0.8~dev68-3.25.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-neutron-vsphere 2.0.1~dev167-3.3.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-nova 18.3.1~dev38-3.25.4 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-octavia 3.2.3~dev7-3.25.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-octavia-amphora-image 0.1.4-7.12.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 openstack-resource-agents 1.0+git.1569436425.8b9c49f-5.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-Django1 1.11.29-3.15.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-Pillow 5.2.0-3.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-heatclient 1.16.3-3.3.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-neutron-tempest-plugin +1 0.2.0-3.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-os-brick 2.5.10-3.12.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-oslo.messaging 8.1.4-3.6.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-pyroute2 0.5.2-4.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-urllib3 1.23-3.12.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 python-waitress 1.4.3-3.3.1 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 release-notes-suse-openstack-cloud 9.20200610-3.21.4 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 rubygem-activeresource 4.0.0-4.3.1 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 rubygem-json-1_7 1.7.7-4.3.1 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud Crowbar 9 rubygem-puma 2.16.0-4.9.1 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ansible1 1.9.6-9.7.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-ansible 9.0+git.1591138508.e269bdb-3.22.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-cobbler 9.0+git.1588181228.bae3b1f-3.13.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-glance 9.0+git.1593631708.9354a78-3.13.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-input-model 9.0+git.1589740948.c24fc0b-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-logging 9.0+git.1591193994.d93b668-3.13.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-manila 9.0+git.1594158642.b5905e4-3.12.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-monasca 9.0+git.1589385256.7fbfaaf-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-mq 9.0+git.1593618110.cbd1a37-3.16.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-neutron 9.0+git.1590756257.e09d54f-3.22.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-octavia 9.0+git.1590079609.a2ae6ab-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 ardana-tempest 9.0+git.1593033709.9495bb2-3.16.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 grafana 6.2.5-3.12.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 kibana 4.6.3-4.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-barbican 7.0.1~dev24-3.9.5 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-ceilometer 11.1.1~dev7-3.16.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-cinder 13.0.10~dev12-3.22.4 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-dashboard 14.1.1~dev6-3.15.5 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-designate 7.0.2~dev2-3.19.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-heat-templates 0.0.0+git.1582270132.8a20477-3.6.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-ironic 11.1.5~dev6-3.19.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-keystone 14.2.1~dev4-3.22.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-magnum 7.2.1~dev1-3.13.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-manila 7.4.2~dev31-4.24.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-monasca-agent 2.8.2~dev5-3.9.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-neutron 13.0.8~dev68-3.25.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-neutron-vsphere 2.0.1~dev167-3.3.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-nova 18.3.1~dev38-3.25.4 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-octavia 3.2.3~dev7-3.25.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-octavia-amphora-image 0.1.4-7.12.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 openstack-resource-agents 1.0+git.1569436425.8b9c49f-5.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-Django1 1.11.29-3.15.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-Pillow 5.2.0-3.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-ardana-packager 0.0.3-9.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-heatclient 1.16.3-3.3.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-neutron-tempest-plugin +1 0.2.0-3.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-os-brick 2.5.10-3.12.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-oslo.messaging 8.1.4-3.6.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-pyroute2 0.5.2-4.3.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-urllib3 1.23-3.12.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 python-waitress 1.4.3-3.3.1 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 release-notes-suse-openstack-cloud 9.20200610-3.21.4 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-barbican 7.0.1~dev24-3.19.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-cinder 13.0.10~dev12-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-designate 7.0.2~dev2-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-glance 17.0.1~dev30-3.17.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-heat 11.0.3~dev35-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-horizon 14.1.1~dev6-4.18.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-ironic 11.1.5~dev6-4.15.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-keystone 14.2.1~dev4-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-magnum 7.2.1~dev1-4.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-manila 7.4.2~dev31-3.21.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-monasca 2.7.1~dev10-3.17.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-monasca-ceilometer 1.8.2~dev3-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-neutron 13.0.8~dev68-6.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-nova 18.3.1~dev38-3.19.3 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-octavia 3.2.3~dev7-4.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-sahara 9.0.2~dev15-3.19.2 SUSE-RU-2020:2161-1
SUSE OpenStack Cloud 9 venv-openstack-swift 2.19.2~dev48-2.14.2 SUSE-RU-2020:2161-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI cinder >= 14.0.0, < 14.1.0 14.1.0 GHSA-v3m2-pg96-w33m
PyPI cinder >= 15.0.0, < 15.2.0 15.2.0 GHSA-v3m2-pg96-w33m
PyPI cinder >= 16.0.0, < 16.1.0 16.1.0 GHSA-v3m2-pg96-w33m
PyPI cinder < 14.1.0 · >= 15.0.0, < 15.2.0 · >= 16.0.0, < 16.1.0 14.1.0, 15.2.0, 16.1.0 PYSEC-2020-228
PyPI os-brick >= 2.8.0, < 2.8.6 2.8.6 GHSA-v3m2-pg96-w33m
PyPI os-brick >= 2.10.0, < 2.10.4 2.10.4 GHSA-v3m2-pg96-w33m
PyPI os-brick >= 3.0.0, < 3.0.2 3.0.2 GHSA-v3m2-pg96-w33m
PyPI os-brick >= 2.8.0, < 2.8.6 · >= 2.10.0, < 2.10.4 · >= 3.0.0, < 3.0.2 2.8.6, 2.10.4, 3.0.2 PYSEC-2026-891

Advisories 4

References